Apollo

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:04 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Apollo.io API helper, but its credential configuration handling is unsafe enough to warrant review before installation.

Install only if you are comfortable reviewing or fixing the shell scripts first. Use a least-privileged Apollo key where possible, keep the config file private and non-writable by others, set APOLLO_BASE_URL only to the intended Apollo HTTPS API origin, and be aware that the current scripts may read a hardcoded developer path instead of the documented config/apollo.env file.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/apollo-config.sh:7

Finding

Executable Configuration File Allows Arbitrary Shell Command Execution

Content

View full analysis

Vulnerability Details

File Location: scripts/apollo-config.sh, lines 7–12
Vulnerability Type: Unsafe shell configuration loading
Risk Level: High

Vulnerable Code:

bash

CONFIG_FILE="/Users/jhumanj/clawd/config/apollo.env"

if [ -f "$CONFIG_FILE" ]; then
  # shellcheck disable=SC1090
  source "$CONFIG_FILE"
fi

Technical Analysis

The script loads apollo.env with Bash's source built-in. Although the file is presented as an environment configuration file, source interprets its entire contents as executable shell code. Command substitutions, function declarations, commands, redirections, and other shell constructs in the file therefore execute with the privileges of the user invoking any Apollo helper.

The configuration path is also a fixed, developer-specific absolute path. This conflicts with the documentation in SKILL.md, which tells users to create config/apollo.env, and may cause the script to load an unexpected file outside the project directory.

Attack Path

1. An attacker obtains write access to /Users/jhumanj/clawd/config/apollo.env, replaces it, or causes a malicious file to exist at that fixed path.
2. The attacker inserts executable shell content, such as a command substitution or an ordinary shell command.
3. The user invokes apollo-get.sh or apollo-post.sh.
4. The helper sources apollo-config.sh.
5. apollo-config.sh sources the attacker-controlled environment file.
6. The injected commands execute as the invoking user before the Apollo request is made.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. The attacker could read or modify files accessible to that user, steal environment variables and API credentials, alter project content, or execute additional local programs. This code does not itself elevate privileges, so the scope remains bounded by the user's existing permissions ...[truncated 1 chars]

Remediation

View remediation

Remediation Suggestions

• Do not use source to parse a data-only configuration file.
• Resolve the configuration file relative to the project directory, or accept an explicit path from a trusted invocation parameter.
• Parse only an allowlist of keys, such as APOLLO_BASE_URL and APOLLO_API_KEY, using a non-executing parser.
• Reject shell metacharacters, command substitutions, unknown keys, malformed records, duplicate keys, and multiline values.
• Verify that the file is a regular file, is owned by the expected user, and is not group- or world-writable.
• Recommend restrictive permissions such as 0600.
• Prefer process environment variables or a dedicated secrets manager where available.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/apollo-config.sh:14

Finding

Unvalidated API Base URL Can Exfiltrate the Apollo API Key

Content

View full analysis

Vulnerability Details

File Location: scripts/apollo-config.sh, lines 14–27; credential transmission occurs in scripts/apollo-get.sh, lines 19–26, and scripts/apollo-post.sh, lines 19–25
Vulnerability Type: Unrestricted credential destination and insecure transport
Risk Level: High

Vulnerable Code:

bash

if [ -z "${APOLLO_BASE_URL:-}" ]; then
  echo "Missing APOLLO_BASE_URL. Create $CONFIG_FILE (see /Users/jhumanj/clawd/config/apollo.env.example)." >&2
  exit 1
fi

if [ -z "${APOLLO_API_KEY:-}" ]; then
  echo "Missing APOLLO_API_KEY. Create $CONFIG_FILE (see /Users/jhumanj/clawd/config/apollo.env.example)." >&2
  exit 1
fi

APOLLO_BASE_URL="${APOLLO_BASE_URL%/}"

export APOLLO_BASE_URL
export APOLLO_API_KEY

The GET helper subsequently transmits the credential without validating the destination:

bash

URL="$APOLLO_BASE_URL$PATH_PART"
if [ -n "$QUERY" ]; then
  URL="$URL?$QUERY"
fi

curl -sS "$URL" \
  -H "X-Api-Key: $APOLLO_API_KEY" \
  -H "Accept: application/json"

The POST helper has equivalent behavior:

bash

URL="$APOLLO_BASE_URL$PATH_PART"

curl -sS -X POST "$URL" \
  -H "X-Api-Key: $APOLLO_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  --data "$JSON_BODY"

Technical Analysis

APOLLO_BASE_URL is checked only for a nonempty value. The code does not require HTTPS, verify that the hostname belongs to Apollo, reject embedded credentials, or otherwise constrain the destination before attaching APOLLO_API_KEY as an X-Api-Key header.

Consequently, anyone who can influence the configuration can redirect authenticated requests to an attacker-controlled endpoint. A cleartext http:// URL could additionally expose the credential to network observers.

Attack Path

1. An attacker modifies or influences the Apollo configuration.
2. The attacker sets APOLLO_BASE_URL to an endpoint they ...[truncated 905 chars]

Remediation

View remediation

Remediation Suggestions

• Remove configurable origins unless alternate Apollo endpoints are operationally required.
• Default to and allowlist the exact expected origin, normally https://api.apollo.io.
• Parse the URL structurally and require the https scheme, an approved hostname, and an approved port.
• Reject URLs containing user information, fragments, malformed authorities, or unexpected schemes.
• Ensure credentials are never forwarded to a different origin during redirects; preferably disable redirects, or explicitly constrain them to the same approved HTTPS origin.
• Keep endpoint paths separate from the origin and require them to begin with a single /.
• Avoid exporting the API key globally unless child processes genuinely require it.
• Rotate the Apollo API key if requests may already have been sent to an untrusted destination.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill exposes shell-based scripts but does not declare any tool restrictions such as permissions or allowed-tools. That means an agent or runtime may permit broader shell execution than intended, increasing the chance of command execution against local files, environment secrets, or the network beyond the documented Apollo API use case.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/apollo-post.sh (reported line 21)May include surrounding context.

sh

URL="$APOLLO_BASE_URL$PATH_PART"

curl -sS -X POST "$URL" \
  -H "X-Api-Key: $APOLLO_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This shell script invokes another script to call the /organizations/bulk endpoint, and the header comment notes that it often requires a master API key. However, that disclosure exists only as an internal code comment, not as a user-facing prompt, warning, or confirmation during execution, so a user running the script may not be explicitly warned about the sensitive credential use or data access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.